blob: b19086eea420db39bfcddf6918b91c57d7ca4ecb [file] [log] [blame]
Shawn Willden9d645a02014-06-12 13:48:46 -06001/*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#ifndef ANDROID_HARDWARE_KEYMASTER_DEFS_H
18#define ANDROID_HARDWARE_KEYMASTER_DEFS_H
19
20#include <stdint.h>
21#include <stdlib.h>
22#include <string.h>
23
Shawn Willden7eaa15f2015-06-03 09:03:20 -060024#ifdef __cplusplus
Shawn Willdenc51d01e2015-03-18 18:59:52 -060025extern "C" {
26#endif // __cplusplus
Shawn Willden9d645a02014-06-12 13:48:46 -060027
Shawn Willden9d645a02014-06-12 13:48:46 -060028/**
29 * Authorization tags each have an associated type. This enumeration facilitates tagging each with
30 * a type, by using the high four bits (of an implied 32-bit unsigned enum value) to specify up to
31 * 16 data types. These values are ORed with tag IDs to generate the final tag ID values.
32 */
33typedef enum {
34 KM_INVALID = 0 << 28, /* Invalid type, used to designate a tag as uninitialized */
35 KM_ENUM = 1 << 28,
36 KM_ENUM_REP = 2 << 28, /* Repeatable enumeration value. */
Shawn Willdenfe6bcfa2015-06-24 20:59:14 +000037 KM_UINT = 3 << 28,
38 KM_UINT_REP = 4 << 28, /* Repeatable integer value */
39 KM_ULONG = 5 << 28,
Shawn Willden9d645a02014-06-12 13:48:46 -060040 KM_DATE = 6 << 28,
41 KM_BOOL = 7 << 28,
42 KM_BIGNUM = 8 << 28,
43 KM_BYTES = 9 << 28,
Shawn Willdenfe6bcfa2015-06-24 20:59:14 +000044 KM_ULONG_REP = 10 << 28, /* Repeatable long value */
Shawn Willden9d645a02014-06-12 13:48:46 -060045} keymaster_tag_type_t;
46
47typedef enum {
48 KM_TAG_INVALID = KM_INVALID | 0,
49
50 /*
51 * Tags that must be semantically enforced by hardware and software implementations.
52 */
53
54 /* Crypto parameters */
Shawn Willden79d79342015-02-10 14:29:46 -070055 KM_TAG_PURPOSE = KM_ENUM_REP | 1, /* keymaster_purpose_t. */
56 KM_TAG_ALGORITHM = KM_ENUM | 2, /* keymaster_algorithm_t. */
Shawn Willdenfe6bcfa2015-06-24 20:59:14 +000057 KM_TAG_KEY_SIZE = KM_UINT | 3, /* Key size in bits. */
Shawn Willdenfe895d12015-02-25 17:33:40 -070058 KM_TAG_BLOCK_MODE = KM_ENUM_REP | 4, /* keymaster_block_mode_t. */
59 KM_TAG_DIGEST = KM_ENUM_REP | 5, /* keymaster_digest_t. */
60 KM_TAG_PADDING = KM_ENUM_REP | 6, /* keymaster_padding_t. */
Shawn Willden4144c642015-06-01 11:40:34 -060061 KM_TAG_CALLER_NONCE = KM_BOOL | 7, /* Allow caller to specify nonce or IV. */
Shawn Willdena3f0ab52015-07-08 06:04:52 -060062 KM_TAG_MIN_MAC_LENGTH = KM_UINT | 8, /* Minimum length of MAC or AEAD authentication tag in
63 * bits. */
Shawn Willden9d645a02014-06-12 13:48:46 -060064
Shawn Willden9d645a02014-06-12 13:48:46 -060065 /* Algorithm-specific. */
Shawn Willdenfe6bcfa2015-06-24 20:59:14 +000066 KM_TAG_RSA_PUBLIC_EXPONENT = KM_ULONG | 200,
Shawn Willden9d645a02014-06-12 13:48:46 -060067
Shawn Willdenfb769fc2015-05-11 09:24:48 -060068 /* Other hardware-enforced. */
69 KM_TAG_BLOB_USAGE_REQUIREMENTS = KM_ENUM | 301, /* keymaster_key_blob_usage_requirements_t */
70 KM_TAG_BOOTLOADER_ONLY = KM_BOOL | 302, /* Usable only by bootloader */
71
Shawn Willden9d645a02014-06-12 13:48:46 -060072 /*
73 * Tags that should be semantically enforced by hardware if possible and will otherwise be
74 * enforced by software (keystore).
75 */
76
77 /* Key validity period */
78 KM_TAG_ACTIVE_DATETIME = KM_DATE | 400, /* Start of validity */
79 KM_TAG_ORIGINATION_EXPIRE_DATETIME = KM_DATE | 401, /* Date when new "messages" should no
80 longer be created. */
81 KM_TAG_USAGE_EXPIRE_DATETIME = KM_DATE | 402, /* Date when existing "messages" should no
82 longer be trusted. */
Shawn Willdenfe6bcfa2015-06-24 20:59:14 +000083 KM_TAG_MIN_SECONDS_BETWEEN_OPS = KM_UINT | 403, /* Minimum elapsed time between
Shawn Willden9d645a02014-06-12 13:48:46 -060084 cryptographic operations with the key. */
Shawn Willdenfe6bcfa2015-06-24 20:59:14 +000085 KM_TAG_MAX_USES_PER_BOOT = KM_UINT | 404, /* Number of times the key can be used per
Shawn Willdendc0007b2015-01-23 01:01:21 -070086 boot. */
Shawn Willden9d645a02014-06-12 13:48:46 -060087
88 /* User authentication */
Shawn Willdenfe6bcfa2015-06-24 20:59:14 +000089 KM_TAG_ALL_USERS = KM_BOOL | 500, /* Reserved for future use -- ignore */
90 KM_TAG_USER_ID = KM_UINT | 501, /* Reserved for future use -- ignore */
91 KM_TAG_USER_SECURE_ID = KM_ULONG_REP | 502, /* Secure ID of authorized user or authenticator(s).
92 Disallowed if KM_TAG_ALL_USERS or
93 KM_TAG_NO_AUTH_REQUIRED is present. */
94 KM_TAG_NO_AUTH_REQUIRED = KM_BOOL | 503, /* If key is usable without authentication. */
95 KM_TAG_USER_AUTH_TYPE = KM_ENUM | 504, /* Bitmask of authenticator types allowed when
96 * KM_TAG_USER_SECURE_ID contains a secure user ID,
97 * rather than a secure authenticator ID. Defined in
98 * hw_authenticator_type_t in hw_auth_token.h. */
99 KM_TAG_AUTH_TIMEOUT = KM_UINT | 505, /* Required freshness of user authentication for
100 private/secret key operations, in seconds.
101 Public key operations require no authentication.
102 If absent, authentication is required for every
103 use. Authentication state is lost when the
104 device is powered off. */
Shawn Willden9d645a02014-06-12 13:48:46 -0600105
106 /* Application access control */
Shawn Willden7ac0c0f2015-06-18 12:15:09 -0600107 KM_TAG_ALL_APPLICATIONS = KM_BOOL | 600, /* Reserved for future use -- ignore */
108 KM_TAG_APPLICATION_ID = KM_BYTES | 601, /* Reserved for fugure use -- ignore */
Shawn Willden9d645a02014-06-12 13:48:46 -0600109
110 /*
111 * Semantically unenforceable tags, either because they have no specific meaning or because
112 * they're informational only.
113 */
114 KM_TAG_APPLICATION_DATA = KM_BYTES | 700, /* Data provided by authorized application. */
115 KM_TAG_CREATION_DATETIME = KM_DATE | 701, /* Key creation time */
116 KM_TAG_ORIGIN = KM_ENUM | 702, /* keymaster_key_origin_t. */
117 KM_TAG_ROLLBACK_RESISTANT = KM_BOOL | 703, /* Whether key is rollback-resistant. */
118 KM_TAG_ROOT_OF_TRUST = KM_BYTES | 704, /* Root of trust ID. Empty array means usable by all
119 roots. */
120
Shawn Willden67ba9e82015-02-06 17:04:53 -0700121 /* Tags used only to provide data to or receive data from operations */
122 KM_TAG_ASSOCIATED_DATA = KM_BYTES | 1000, /* Used to provide associated data for AEAD modes. */
Shawn Willden41e91e92015-01-30 06:23:26 -0700123 KM_TAG_NONCE = KM_BYTES | 1001, /* Nonce or Initialization Vector */
Shawn Willdenda89dde2015-06-18 12:09:20 -0600124 KM_TAG_AUTH_TOKEN = KM_BYTES | 1002, /* Authentication token that proves secure user
Shawn Willdenc3ab05c2015-03-14 08:23:41 -0600125 authentication has been performed. Structure
126 defined in hw_auth_token_t in hw_auth_token.h. */
Shawn Willdenfe6bcfa2015-06-24 20:59:14 +0000127 KM_TAG_MAC_LENGTH = KM_UINT | 1003, /* MAC or AEAD authentication tag length in bits. */
Shawn Willden9d645a02014-06-12 13:48:46 -0600128} keymaster_tag_t;
129
130/**
131 * Algorithms that may be provided by keymaster implementations. Those that must be provided by all
Shawn Willdenfd4b4d52015-02-24 09:17:38 -0700132 * implementations are tagged as "required".
Shawn Willden9d645a02014-06-12 13:48:46 -0600133 */
134typedef enum {
135 /* Asymmetric algorithms. */
Shawn Willdene9797a72015-04-07 13:39:12 -0600136 KM_ALGORITHM_RSA = 1,
137 // KM_ALGORITHM_DSA = 2, -- Removed, do not re-use value 2.
138 KM_ALGORITHM_EC = 3,
139
140 /* Block ciphers algorithms */
141 KM_ALGORITHM_AES = 32,
142
Shawn Willden9d645a02014-06-12 13:48:46 -0600143 /* MAC algorithms */
Shawn Willdene9797a72015-04-07 13:39:12 -0600144 KM_ALGORITHM_HMAC = 128,
Shawn Willden9d645a02014-06-12 13:48:46 -0600145} keymaster_algorithm_t;
146
147/**
Shawn Willdenc7deeda2015-04-07 13:40:00 -0600148 * Symmetric block cipher modes provided by keymaster implementations.
Shawn Willden9d645a02014-06-12 13:48:46 -0600149 */
150typedef enum {
151 /* Unauthenticated modes, usable only for encryption/decryption and not generally recommended
152 * except for compatibility with existing other protocols. */
Shawn Willden4c19a3a2015-06-01 11:40:24 -0600153 KM_MODE_ECB = 1,
Shawn Willdenc7deeda2015-04-07 13:40:00 -0600154 KM_MODE_CBC = 2,
Shawn Willden4c19a3a2015-06-01 11:40:24 -0600155 KM_MODE_CTR = 3,
Shawn Willdenc7deeda2015-04-07 13:40:00 -0600156
Shawn Willden9d645a02014-06-12 13:48:46 -0600157 /* Authenticated modes, usable for encryption/decryption and signing/verification. Recommended
Shawn Willdenc7deeda2015-04-07 13:40:00 -0600158 * over unauthenticated modes for all purposes. */
Shawn Willden4c19a3a2015-06-01 11:40:24 -0600159 KM_MODE_GCM = 32,
Shawn Willden9d645a02014-06-12 13:48:46 -0600160} keymaster_block_mode_t;
161
162/**
163 * Padding modes that may be applied to plaintext for encryption operations. This list includes
164 * padding modes for both symmetric and asymmetric algorithms. Note that implementations should not
165 * provide all possible combinations of algorithm and padding, only the
166 * cryptographically-appropriate pairs.
167 */
168typedef enum {
Shawn Willden8412fdc2015-04-07 13:41:30 -0600169 KM_PAD_NONE = 1, /* deprecated */
170 KM_PAD_RSA_OAEP = 2,
171 KM_PAD_RSA_PSS = 3,
Shawn Willden9d645a02014-06-12 13:48:46 -0600172 KM_PAD_RSA_PKCS1_1_5_ENCRYPT = 4,
173 KM_PAD_RSA_PKCS1_1_5_SIGN = 5,
Shawn Willden8412fdc2015-04-07 13:41:30 -0600174 KM_PAD_PKCS7 = 64,
Shawn Willden9d645a02014-06-12 13:48:46 -0600175} keymaster_padding_t;
176
177/**
Shawn Willdenfe6c4f02015-04-07 14:02:28 -0600178 * Digests provided by keymaster implementations.
Shawn Willden9d645a02014-06-12 13:48:46 -0600179 */
180typedef enum {
Shawn Willdenfe6c4f02015-04-07 14:02:28 -0600181 KM_DIGEST_NONE = 0,
182 KM_DIGEST_MD5 = 1, /* Optional, may not be implemented in hardware, will be handled in software
183 * if needed. */
184 KM_DIGEST_SHA1 = 2,
185 KM_DIGEST_SHA_2_224 = 3,
186 KM_DIGEST_SHA_2_256 = 4,
187 KM_DIGEST_SHA_2_384 = 5,
188 KM_DIGEST_SHA_2_512 = 6,
Shawn Willden9d645a02014-06-12 13:48:46 -0600189} keymaster_digest_t;
190
191/**
Shawn Willden8d6cf252015-04-07 13:56:30 -0600192 * The origin of a key (or pair), i.e. where it was generated. Note that KM_TAG_ORIGIN can be found
193 * in either the hardware-enforced or software-enforced list for a key, indicating whether the key
194 * is hardware or software-based. Specifically, a key with KM_ORIGIN_GENERATED in the
195 * hardware-enforced list is guaranteed never to have existed outide the secure hardware.
Shawn Willden9d645a02014-06-12 13:48:46 -0600196 */
197typedef enum {
Shawn Willden8d6cf252015-04-07 13:56:30 -0600198 KM_ORIGIN_GENERATED = 0, /* Generated in keymaster */
Shawn Willdend359b042015-04-13 11:07:24 -0600199 KM_ORIGIN_IMPORTED = 2, /* Imported, origin unknown */
200 KM_ORIGIN_UNKNOWN = 3, /* Keymaster did not record origin. This value can only be seen on
201 * keys in a keymaster0 implementation. The keymaster0 adapter uses
202 * this value to document the fact that it is unkown whether the key
203 * was generated inside or imported into keymaster. */
Shawn Willden9d645a02014-06-12 13:48:46 -0600204} keymaster_key_origin_t;
205
206/**
207 * Usability requirements of key blobs. This defines what system functionality must be available
208 * for the key to function. For example, key "blobs" which are actually handles referencing
209 * encrypted key material stored in the file system cannot be used until the file system is
210 * available, and should have BLOB_REQUIRES_FILE_SYSTEM. Other requirements entries will be added
211 * as needed for implementations. This type is new in 0_4.
212 */
213typedef enum {
214 KM_BLOB_STANDALONE = 0,
215 KM_BLOB_REQUIRES_FILE_SYSTEM = 1,
216} keymaster_key_blob_usage_requirements_t;
217
218/**
219 * Possible purposes of a key (or pair). This type is new in 0_4.
220 */
221typedef enum {
222 KM_PURPOSE_ENCRYPT = 0,
223 KM_PURPOSE_DECRYPT = 1,
224 KM_PURPOSE_SIGN = 2,
225 KM_PURPOSE_VERIFY = 3,
226} keymaster_purpose_t;
227
228typedef struct {
229 const uint8_t* data;
230 size_t data_length;
231} keymaster_blob_t;
232
233typedef struct {
234 keymaster_tag_t tag;
235 union {
236 uint32_t enumerated; /* KM_ENUM and KM_ENUM_REP */
237 bool boolean; /* KM_BOOL */
238 uint32_t integer; /* KM_INT and KM_INT_REP */
239 uint64_t long_integer; /* KM_LONG */
240 uint64_t date_time; /* KM_DATE */
241 keymaster_blob_t blob; /* KM_BIGNUM and KM_BYTES*/
242 };
243} keymaster_key_param_t;
244
245typedef struct {
246 keymaster_key_param_t* params; /* may be NULL if length == 0 */
247 size_t length;
248} keymaster_key_param_set_t;
249
250/**
251 * Parameters that define a key's characteristics, including authorized modes of usage and access
252 * control restrictions. The parameters are divided into two categories, those that are enforced by
253 * secure hardware, and those that are not. For a software-only keymaster implementation the
254 * enforced array must NULL. Hardware implementations must enforce everything in the enforced
255 * array.
256 */
257typedef struct {
258 keymaster_key_param_set_t hw_enforced;
259 keymaster_key_param_set_t sw_enforced;
260} keymaster_key_characteristics_t;
261
262typedef struct {
263 const uint8_t* key_material;
264 size_t key_material_size;
265} keymaster_key_blob_t;
266
267/**
268 * Formats for key import and export. At present, only asymmetric key import/export is supported.
269 * In the future this list will expand greatly to accommodate asymmetric key import/export.
270 */
271typedef enum {
Shawn Willdenfb769fc2015-05-11 09:24:48 -0600272 KM_KEY_FORMAT_X509 = 0, /* for public key export */
273 KM_KEY_FORMAT_PKCS8 = 1, /* for asymmetric key pair import */
274 KM_KEY_FORMAT_RAW = 3, /* for symmetric key import */
Shawn Willden9d645a02014-06-12 13:48:46 -0600275} keymaster_key_format_t;
276
277/**
278 * The keymaster operation API consists of begin, update, finish and abort. This is the type of the
279 * handle used to tie the sequence of calls together. A 64-bit value is used because it's important
280 * that handles not be predictable. Implementations must use strong random numbers for handle
281 * values.
282 */
283typedef uint64_t keymaster_operation_handle_t;
284
285typedef enum {
286 KM_ERROR_OK = 0,
287 KM_ERROR_ROOT_OF_TRUST_ALREADY_SET = -1,
288 KM_ERROR_UNSUPPORTED_PURPOSE = -2,
289 KM_ERROR_INCOMPATIBLE_PURPOSE = -3,
290 KM_ERROR_UNSUPPORTED_ALGORITHM = -4,
291 KM_ERROR_INCOMPATIBLE_ALGORITHM = -5,
292 KM_ERROR_UNSUPPORTED_KEY_SIZE = -6,
293 KM_ERROR_UNSUPPORTED_BLOCK_MODE = -7,
294 KM_ERROR_INCOMPATIBLE_BLOCK_MODE = -8,
Shawn Willden6b424be2015-01-26 13:04:28 -0700295 KM_ERROR_UNSUPPORTED_MAC_LENGTH = -9,
Shawn Willden9d645a02014-06-12 13:48:46 -0600296 KM_ERROR_UNSUPPORTED_PADDING_MODE = -10,
297 KM_ERROR_INCOMPATIBLE_PADDING_MODE = -11,
298 KM_ERROR_UNSUPPORTED_DIGEST = -12,
299 KM_ERROR_INCOMPATIBLE_DIGEST = -13,
300 KM_ERROR_INVALID_EXPIRATION_TIME = -14,
301 KM_ERROR_INVALID_USER_ID = -15,
302 KM_ERROR_INVALID_AUTHORIZATION_TIMEOUT = -16,
303 KM_ERROR_UNSUPPORTED_KEY_FORMAT = -17,
304 KM_ERROR_INCOMPATIBLE_KEY_FORMAT = -18,
305 KM_ERROR_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM = -19, /* For PKCS8 & PKCS12 */
306 KM_ERROR_UNSUPPORTED_KEY_VERIFICATION_ALGORITHM = -20, /* For PKCS8 & PKCS12 */
307 KM_ERROR_INVALID_INPUT_LENGTH = -21,
308 KM_ERROR_KEY_EXPORT_OPTIONS_INVALID = -22,
309 KM_ERROR_DELEGATION_NOT_ALLOWED = -23,
310 KM_ERROR_KEY_NOT_YET_VALID = -24,
311 KM_ERROR_KEY_EXPIRED = -25,
312 KM_ERROR_KEY_USER_NOT_AUTHENTICATED = -26,
313 KM_ERROR_OUTPUT_PARAMETER_NULL = -27,
314 KM_ERROR_INVALID_OPERATION_HANDLE = -28,
315 KM_ERROR_INSUFFICIENT_BUFFER_SPACE = -29,
316 KM_ERROR_VERIFICATION_FAILED = -30,
317 KM_ERROR_TOO_MANY_OPERATIONS = -31,
318 KM_ERROR_UNEXPECTED_NULL_POINTER = -32,
319 KM_ERROR_INVALID_KEY_BLOB = -33,
320 KM_ERROR_IMPORTED_KEY_NOT_ENCRYPTED = -34,
321 KM_ERROR_IMPORTED_KEY_DECRYPTION_FAILED = -35,
322 KM_ERROR_IMPORTED_KEY_NOT_SIGNED = -36,
323 KM_ERROR_IMPORTED_KEY_VERIFICATION_FAILED = -37,
324 KM_ERROR_INVALID_ARGUMENT = -38,
325 KM_ERROR_UNSUPPORTED_TAG = -39,
326 KM_ERROR_INVALID_TAG = -40,
327 KM_ERROR_MEMORY_ALLOCATION_FAILED = -41,
Shawn Willden9d645a02014-06-12 13:48:46 -0600328 KM_ERROR_IMPORT_PARAMETER_MISMATCH = -44,
329 KM_ERROR_SECURE_HW_ACCESS_DENIED = -45,
330 KM_ERROR_OPERATION_CANCELLED = -46,
331 KM_ERROR_CONCURRENT_ACCESS_CONFLICT = -47,
332 KM_ERROR_SECURE_HW_BUSY = -48,
333 KM_ERROR_SECURE_HW_COMMUNICATION_FAILED = -49,
334 KM_ERROR_UNSUPPORTED_EC_FIELD = -50,
Shawn Willdened941112015-03-11 21:53:59 -0600335 KM_ERROR_MISSING_NONCE = -51,
336 KM_ERROR_INVALID_NONCE = -52,
Shawn Willden4144c642015-06-01 11:40:34 -0600337 KM_ERROR_MISSING_MAC_LENGTH = -53,
Shawn Willden396d6cb2015-06-18 12:16:17 -0600338 KM_ERROR_KEY_RATE_LIMIT_EXCEEDED = -54,
Shawn Willden4bdd7cb2015-04-28 00:00:27 -0600339 KM_ERROR_CALLER_NONCE_PROHIBITED = -55,
Shawn Willden396d6cb2015-06-18 12:16:17 -0600340 KM_ERROR_KEY_MAX_OPS_EXCEEDED = -56,
Shawn Willdena3f0ab52015-07-08 06:04:52 -0600341 KM_ERROR_INVALID_MAC_LENGTH = -57,
342 KM_ERROR_MISSING_MIN_MAC_LENGTH = -58,
343 KM_ERROR_UNSUPPORTED_MIN_MAC_LENGTH = -59,
Shawn Willdened941112015-03-11 21:53:59 -0600344
Shawn Willden9d645a02014-06-12 13:48:46 -0600345 KM_ERROR_UNIMPLEMENTED = -100,
346 KM_ERROR_VERSION_MISMATCH = -101,
347
348 /* Additional error codes may be added by implementations, but implementers should coordinate
349 * with Google to avoid code collision. */
350 KM_ERROR_UNKNOWN_ERROR = -1000,
351} keymaster_error_t;
352
Shawn Willden9d645a02014-06-12 13:48:46 -0600353/* Convenience functions for manipulating keymaster tag types */
354
355static inline keymaster_tag_type_t keymaster_tag_get_type(keymaster_tag_t tag) {
356 return (keymaster_tag_type_t)(tag & (0xF << 28));
357}
358
359static inline uint32_t keymaster_tag_mask_type(keymaster_tag_t tag) {
360 return tag & 0x0FFFFFFF;
361}
362
363static inline bool keymaster_tag_type_repeatable(keymaster_tag_type_t type) {
364 switch (type) {
Shawn Willdenfe6bcfa2015-06-24 20:59:14 +0000365 case KM_UINT_REP:
Shawn Willden9d645a02014-06-12 13:48:46 -0600366 case KM_ENUM_REP:
367 return true;
368 default:
369 return false;
370 }
371}
372
373static inline bool keymaster_tag_repeatable(keymaster_tag_t tag) {
374 return keymaster_tag_type_repeatable(keymaster_tag_get_type(tag));
375}
376
377/* Convenience functions for manipulating keymaster_key_param_t structs */
378
379inline keymaster_key_param_t keymaster_param_enum(keymaster_tag_t tag, uint32_t value) {
380 // assert(keymaster_tag_get_type(tag) == KM_ENUM || keymaster_tag_get_type(tag) == KM_ENUM_REP);
381 keymaster_key_param_t param;
382 memset(&param, 0, sizeof(param));
383 param.tag = tag;
384 param.enumerated = value;
385 return param;
386}
387
388inline keymaster_key_param_t keymaster_param_int(keymaster_tag_t tag, uint32_t value) {
389 // assert(keymaster_tag_get_type(tag) == KM_INT || keymaster_tag_get_type(tag) == KM_INT_REP);
390 keymaster_key_param_t param;
391 memset(&param, 0, sizeof(param));
392 param.tag = tag;
393 param.integer = value;
394 return param;
395}
396
397inline keymaster_key_param_t keymaster_param_long(keymaster_tag_t tag, uint64_t value) {
398 // assert(keymaster_tag_get_type(tag) == KM_LONG);
399 keymaster_key_param_t param;
400 memset(&param, 0, sizeof(param));
401 param.tag = tag;
402 param.long_integer = value;
403 return param;
404}
405
406inline keymaster_key_param_t keymaster_param_blob(keymaster_tag_t tag, const uint8_t* bytes,
407 size_t bytes_len) {
408 // assert(keymaster_tag_get_type(tag) == KM_BYTES || keymaster_tag_get_type(tag) == KM_BIGNUM);
409 keymaster_key_param_t param;
410 memset(&param, 0, sizeof(param));
411 param.tag = tag;
412 param.blob.data = (uint8_t*)bytes;
413 param.blob.data_length = bytes_len;
414 return param;
415}
416
417inline keymaster_key_param_t keymaster_param_bool(keymaster_tag_t tag) {
418 // assert(keymaster_tag_get_type(tag) == KM_BOOL);
419 keymaster_key_param_t param;
420 memset(&param, 0, sizeof(param));
421 param.tag = tag;
422 param.boolean = true;
423 return param;
424}
425
426inline keymaster_key_param_t keymaster_param_date(keymaster_tag_t tag, uint64_t value) {
427 // assert(keymaster_tag_get_type(tag) == KM_DATE);
428 keymaster_key_param_t param;
429 memset(&param, 0, sizeof(param));
430 param.tag = tag;
431 param.date_time = value;
432 return param;
433}
434
Shawn Willden67411d62015-03-04 10:00:38 -0700435#define KEYMASTER_SIMPLE_COMPARE(a, b) (a < b) ? -1 : ((a > b) ? 1 : 0)
436inline int keymaster_param_compare(const keymaster_key_param_t* a, const keymaster_key_param_t* b) {
437 int retval = KEYMASTER_SIMPLE_COMPARE(a->tag, b->tag);
438 if (retval != 0)
439 return retval;
440
441 switch (keymaster_tag_get_type(a->tag)) {
442 case KM_INVALID:
443 case KM_BOOL:
444 return 0;
445 case KM_ENUM:
446 case KM_ENUM_REP:
447 return KEYMASTER_SIMPLE_COMPARE(a->enumerated, b->enumerated);
Shawn Willdenfe6bcfa2015-06-24 20:59:14 +0000448 case KM_UINT:
449 case KM_UINT_REP:
Shawn Willden67411d62015-03-04 10:00:38 -0700450 return KEYMASTER_SIMPLE_COMPARE(a->integer, b->integer);
Shawn Willdenfe6bcfa2015-06-24 20:59:14 +0000451 case KM_ULONG:
452 case KM_ULONG_REP:
Shawn Willden67411d62015-03-04 10:00:38 -0700453 return KEYMASTER_SIMPLE_COMPARE(a->long_integer, b->long_integer);
454 case KM_DATE:
455 return KEYMASTER_SIMPLE_COMPARE(a->date_time, b->date_time);
456 case KM_BIGNUM:
457 case KM_BYTES:
458 // Handle the empty cases.
459 if (a->blob.data_length != 0 && b->blob.data_length == 0)
460 return -1;
461 if (a->blob.data_length == 0 && b->blob.data_length == 0)
462 return 0;
463 if (a->blob.data_length == 0 && b->blob.data_length > 0)
464 return 1;
465
466 retval = memcmp(a->blob.data, b->blob.data, a->blob.data_length < b->blob.data_length
467 ? a->blob.data_length
468 : b->blob.data_length);
469 if (retval != 0)
470 return retval;
471 else if (a->blob.data_length != b->blob.data_length) {
472 // Equal up to the common length; longer one is larger.
473 if (a->blob.data_length < b->blob.data_length)
474 return -1;
475 if (a->blob.data_length > b->blob.data_length)
476 return 1;
477 };
478 }
479
480 return 0;
481}
482#undef KEYMASTER_SIMPLE_COMPARE
483
Shawn Willden9d645a02014-06-12 13:48:46 -0600484inline void keymaster_free_param_values(keymaster_key_param_t* param, size_t param_count) {
485 while (param_count-- > 0) {
486 switch (keymaster_tag_get_type(param->tag)) {
487 case KM_BIGNUM:
488 case KM_BYTES:
489 free((void*)param->blob.data);
490 param->blob.data = NULL;
491 break;
492 default:
493 // NOP
494 break;
495 }
496 ++param;
497 }
498}
499
500inline void keymaster_free_param_set(keymaster_key_param_set_t* set) {
501 if (set) {
502 keymaster_free_param_values(set->params, set->length);
503 free(set->params);
504 set->params = NULL;
505 }
506}
507
508inline void keymaster_free_characteristics(keymaster_key_characteristics_t* characteristics) {
509 if (characteristics) {
510 keymaster_free_param_set(&characteristics->hw_enforced);
511 keymaster_free_param_set(&characteristics->sw_enforced);
512 }
513}
514
Shawn Willden7eaa15f2015-06-03 09:03:20 -0600515#ifdef __cplusplus
Shawn Willdenc51d01e2015-03-18 18:59:52 -0600516} // extern "C"
517#endif // __cplusplus
Shawn Willden9d645a02014-06-12 13:48:46 -0600518
519#endif // ANDROID_HARDWARE_KEYMASTER_DEFS_H